Invite a machine and it answers as myserver.hop from anywhere, on a private address only your machines can reach. A VPN should be as easy as SSH, so it is.
Underneath, this is a peer-to-peer VPN. We call one of these networks a warren, and a machine on it a node.
Machines find each other directly through NAT. When a direct path is blocked, a relay forwards encrypted packets it cannot read, and you can run your own with one flag.
Who is on the network is a document your machines replicate between themselves. Nothing of ours has to be up for your machines to find each other.
You never write firewall rules. Invite someone as a developer and the network already knows what a developer can reach. Everything else is default-deny.
ssh, scp, VNC, a browser, a database client: anything that takes a hostname takes myserver.hop. DNS is set up for you on each machine.
The first machine you install with --host creates the network. Every invite after that grows it.
Any member can mint an invite. It is single-use and expires in 15 minutes.
Install and join in one go. The network interface, the address and the name come up on their own.
Every machine on the network answers by name, on any network, with the tools you already use.
A printer, a NAS, a camera, a whole home or office LAN. One machine that is on that LAN carries the rest.
One port, like ssh -L. Works with a plain client install too. The tunnel ends at the machine's own loopback, so it reaches services running on that machine.
A whole LAN, through one machine. Put WireHop on any machine that sits on the LAN (a Pi is plenty) and let it advertise the LAN's address range. Every other machine on your network then reaches the printer or the NAS by its ordinary LAN address, from anywhere.
Advertising a route is a one-line setting on the bridging machine. How to set it up, in the docs.